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OVERSPEED LIMITER FOR TURBOSHAFT ENGINES 
CROSS REFERENCE TO RELATED APPLICATIONS 

[0001] This application claims priority to U.S. Provisional Patent Application 

Serial No. 60/576,779, filed June 3, 2004, the disclosure of which is herein 
incorporated by reference in its entirety. 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

[0002] The subject invention is directed to control systems for gas turbine 

engines, and more particularly, to power turbine overspeed limiters for turboshaft 
engines used in helicopters. 

2. Background of the Related Art 

[0003] Overspeed limiters for gas turbine engines are known in the prior art. 

The function of an overspeed limiter is to prevent the occurrence of excessive turbine 
speeds by limiting fuel flow to the engine. Examples of prior art overspeed limiters are 
described in U.S. Patent No. 4,302,93 1 to White et al. and U.S. Patent No. 4578,945 to 
Peck et al., the disclosures of which are herein incorporated by reference in their 
entireties. 

[0004] Turboshaft engines installed on helicopters require a unique power 

turbine overspeed limiter. It needs to protect the engine against a loss of load and 
potential power turbine overspeed, and preclude false overspeed limiter trips. False 



limiter trips significantly reduce engine power, and can occur when a pilot is flying the 
helicopter aggressively. 

[0005] In the past, these requirements have been addressed by providing 

overspeed limiters that do not completely shutdown the engine when an overspeed 
condition is detected, but instead trip to a minimum fuel flow condition. Other prior art 
systems shutdown the engine when an overspeed condition is detected, and then restart 
the engine using an auto-relight feature. 

[0006] In modern low inertia gas turbines, minimum fuel flow systems are not 

capable of containing loss-of-load power turbine overspeeds at high altitude, because 
the horsepower requirements are too significant. Auto-relight systems are not 
guaranteed to restart an engine under all operating conditions, especially when the 
primary engine control system has failed and the engine is operating with a simple 
manual backup control. 

[0007] Accordingly, there is a need in the art for an overspeed limiter for a 

turboshaft engine that is capable of effectively handling power turbine overspeeds at 
both high and low altitude. 

SUMMARY OF THE INVENTION 

[0008] The subject invention is directed to a control system for a turboshaft 

engine utilized in a helicopter which includes means for providing minimum fuel flow 
to the engine when an overspeed condition is detected at a relatively low altitude (e.g., 
below 10,000 feet), and means for shutting off fuel flow to the engine, and thus shutting 
down the engine, when an overspeed, loss of load condition is detected at a relatively 
high altitude (e.g. above 10,000 feet), provided that the overspeed, loss of load 
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condition is detected along two different engine speed signal paths, including a 
derivative path and a non-derivative path. 

[0009] The subject invention is also directed to a control system for a turboshaft 

engine which provides a desired minimum fuel flow to the engine when an overspeed 
condition is detected and when the engine is operating in a first operating range and 
shuts off fuel flow to the engine when an overspeed condition is detected and the 
engine is operating in a second operating range. It is presently envisioned that an 
overspeed condition is detected based on at least one of, for example, a power turbine 
speed signal, a gas generator speed signal and main rotor speed signal. 

[00010] Preferably, in the first operating range the engine is operating at a 

relatively low altitude and in the second operating range the engine is operating at a 
relatively high altitude. In a representative system, the relatively low altitude includes 
0 to 10,000 feet above sea level and the relatively high altitude exceeds 10,000 feet 
above sea level, for example. 

[0001 1] In a preferred embodiment, an overspeed condition is detected along two 
different control logic paths, a first logic path which includes derivative and non- 
derivative control logic and a second logic path which includes non-derivative logic 
(e.g. proportional logic). 

[00012] It is envisioned that the control system further includes a hardware latch 

• having reset logic associated therewith. Additionally, the control system can include 
software test interfaces for testing the performance of the control system. 

[00013] In a representative embodiment, a minimum fuel flow is provided to the 
engine when an overspeed condition is detected through a first solenoid valve and the 
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fuel flow to the engine is shut off when an overspeed condition is detected by a second 
solenoid valve. 

[00014] In preferred embodiments the control system is a dual channel system 
having an interchannel communication means for ensuring that a fault in one channel of 
the system will not shut down the control system or impact the systems ability to limit 
engine overspeed. 

[0001 5] The present invention is also directed to a control system for a turboshaft 
engine which includes a mechanism for shutting off fuel flow to the engine when an 
overspeed condition is detected, wherein the overspeed condition is detected by first 
and second control logic paths. It is envisioned that the first control logic path includes 
a derivative path and a non-derivative path and the second control logic path includes a 
non-derivative path. Preferably, the control system includes a device for disabling the 
fuel shut-off mechanism when the engine is operating below an altitude of 10,000 feet. 

[00016] The present disclosure is also directed to a control system for a 
turboshaft engine which includes a mechanism for providing a minimum fuel flow to 
the engine when an overspeed condition is detected in a first operating range; and a 
mechanism for shutting off fuel flow to the engine when an overspeed condition is 
detected in a second operating range. It is preferred that the overspeed condition is 
detected along two different engine speed signal paths, including a derivative path and 
a non-derivative path. 

[00017] Preferably, in the first operating range the engine is operating at a 

relatively low altitude and in the second operating range the engine is operating at a 
relatively high altitude. In a representative system, the relatively low altitude includes 
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0 to 10,000 feet above sea level and the relatively high altitude exceeds 10,000 feet 
above sea level, for example. 

[0001 8] In a preferred embodiment, an overspeed condition is detected along two 
different control logic paths, a first logic path which includes derivative and non- 
derivative control logic and a second logic path which includes non-derivative logic 
(e.g. proportional logic). 

[00019] It is envisioned that the control system further includes a hardware latch 
having reset logic associated therewith. Additionally, the control system can include 
software test interfaces for testing the performance of the control system. 

[00020] In a representative embodiment, a minimum fuel flow is provided to the 
engine when an overspeed condition is detected through a first solenoid valve and the 
fuel flow to the engine is shut off when an overspeed condition is detected by a second 
solenoid valve. 

[00021] In preferred embodiments the control system is a dual channel system 
having an interchannel communication means for ensuring that a fault in one channel of 
the system will not shut down the control system or impact the systems ability to limit 
engine overspeed. 

[00022] The present disclosure is also directed to a method for limiting 

turboshaft engine overspeed that includes measuring at least one engine speed 
parameter; sensing the altitude at which the engine is operating and determining 
whether an overspeed condition exists based on the measured speed parameter. The 
disclosed method uses a control system which includes a first logic path that has 
derivative and non-derivative control logic and a second logic path that has non- 
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derivative logic. The inventive method also includes the steps of providing a desired 
minimum fuel flow to the engine when an overspeed condition is detected by the 
engine control system when the engine is operating in a first altitude range; and 
shutting off fuel flow to the engine when an overspeed condition is detected by the 
engine control system and the engine is operating in a second operating range. 

[00023] These and other aspects of the subject invention will become more 
readily apparent to those having ordinary skill in the art from the following detailed 
description of the invention taken in conjunction with the drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[00024] So that those having ordinary skill in the art will better understand how 

to make and use the overspeed limiter system of the subject invention, embodiments 
thereof will be described below with reference to the drawings wherein: 

[00025] Fig. 1 is a schematic diagram of a fuel metering system for a turboshaft 
engine that employs a preferred embodiment of the overspeed limiter of the subject 
invention; 

[00026] Fig. 2 is a schematic diagram showing representative dual channel 

hardware voting logic, which will shut down the engine upon detecting an overspeed 
condition; 

[00027] Fig. 2a is a cross-sectional view of a portion of the shaft for the power 

turbine having three speed probes positioned adjacent thereto for detecting a shaft 
speed signal; 
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[00028] Fig. 3 is a schematic diagram showing the engine shut down logic path 
of Fig. 2, with a hardware latch; 

[00029] Fig. 4 is a schematic diagram showing the engine shut down logic path 

and hardware latch of Fig. 3, with software test interfaces; 

[00030] Fig. 5 is a schematic diagram showing the engine shutdown logic path 
with hardware latch as shown in Fig. 3, combined with a minimum fuel flow logic path; 

[00031] Fig. 6 is a schematic diagram showing the combined minimum fuel flow 

logic path and engine shutdown logic path of Fig. 5, with cross-engine inhibit features; 
and 

[00032] Fig. 7 is a schematic diagram of an alternate embodiment of the two 

analog overspeed limiter lanes of protection, which include a more precise test of the 
derivative path in Lane 1, as compared to the software test interfaces of Fig. 4. 



DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

[00033] The subject invention overcomes the disadvantages of prior art 

overspeed limiters used on turboshaft engines in helicopters by preferably providing 
both a minimum flow overspeed system for low altitude operation (e.g., below 10,000 
feet) and a fuel shutoff system for high altitude (e.g., above 10,000 feet) 
overspeed/loss-of-load conditions. 

[00034] The system of the subject invention is uniquely implemented in analog 

hardware and in the software of the primary engine control unit (ECU) to satisfy all 
certification standards for: a) the probability of loss of overspeed protection; b) the 
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probability of a false overspeed trip; and c) the probability of a single failure causing an 
engine overspeed condition and loss of overspeed protection at the same time. 

[00035] Referring now to the drawings, wherein like reference numerals identify 
similar aspects or features of the subject invention, there is illustrated in Fig. 1 a 
representative fuel metering system 10 for a turboshaft engine that employs the 
overspeed limiter of the subject invention. As illustrated in Fig. 1, the fuel metering 
system 10 includes, among other things, a venturi-type jet inducer 12, which delivers 
fuel under pressure to a gear pump 14. Gear pump 14 communicates with a high- 
pressure fuel filter 16. Fuel flows from filter 16 to a fuel metering valve 18 operated by 
a stepper motor 20 with associated primary gearhead. A feedback device 22 is 
associated with the metering valve for monitoring the position of the metering valve 18. 
Feedback device 22 has associated limit switches. Also associated with the metering 
valve 18 is a combined DC motor, gearhead and clutch set 24, which serves as a backup 
to the stepper motor 20. 

[00036] A pressurizing and leak tight shutoff valve 26 is in fluid communication 

with fuel metering valve 18. It delivers fuel to the engine by way of a dual coil true 
minimum flow overspeed solenoid valve 28, which is normally de-energized. A fuel 
regulator valve 30 also receives filtered fuel from filter 16. Regulator valve 30 
communicates with the jet inducer 12 and also communicates with a dual coil 
overspeed and fuel shutoff solenoid valve 32 that is normally de-energized. Regulator 
valve 30 is also in fluid communication with fuel metering valve 18. The fuel shutoff 
solenoid valve 32 is also in fluid communication with the pressurizing shutoff valve 26. 
As explained in below, the overspeed limiter system of the subject invention controls 
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the operation of the two dual coil solenoid valves 28 and 32. During normal operating 
conditions, both solenoid valves -28 and 32 are de-energized. 

[00037] Referring now to Fig. 2, there is presented a schematic diagram showing 

the dual channel hardware voting logic which will shutdown the engine upon detecting 
an overspeed condition, provided that the overspeed condition is detected along two NP 
engine signal paths, a first path including a derivative signal path and a second path 
including a non-derivative engine signal path. In a preferred embodiment, the first path 
includes both derivative and proportional control logic while the second path includes 
proportional logic, but does not include derivative logic. 

[00038] As illustrated, two NP engine signals (i.e., power turbine speed signals) 

are brought into each of the two engine control unit (ECU) channels (Channel A and 
Channel B). As shown, two Analog Overspeed Limiter Lanes of protection are 
provided for each channel. The logic for these lanes of overspeed .protection have been 
identified by reference numerals 4 la/43 a for Channel A and reference numerals 
41b/43b for Channel B. Each ECU channel includes a respective shutdown coil (32a, 
32b) of fuel shutoff solenoid 32. 

[00039] Channel A, Analog Overspeed Limiter Lane 1, identified by reference 

number 41a, includes a derivative path and it receives the engine speed signal NPeng3. 
Channel A, Analog Overspeed Limiter Lane 2, identified by reference number 43 a, 
includes a non-derivative path (e.g. proportional logic) and it receives the engine speed 
signal NPEng2. Channel B, Analog Overspeed Limiter Lane 1, identified by reference 
number 41b, includes a derivative path and it receives the engine speed signal 
NPEng2. Channel B, Analog Overspeed Limiter Lane 2, identified by reference 
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number 43b, includes a non-derivative path (e.g., proportional logic) and it receives the 
engine speed signal NPEngl. Fig. 2a shows the NP speed probe location diagram for 
engine speed signals NPEngl, NPEng2 and NPEng3, where NPEng3 is shared with the 
cockpit. 

[00040] The hardware voting scheme of Fig. 2 ensures that: a) no single 
electrical protection system fault will result in a false overspeed trip; and b) no single 
electrical protection system fault will result in a loss of overspeed protection. The 
hardware voting scheme depicted in Fig. 2 requires four output pins 38 for interchannel 
communication. These include two discrete inputs and two discrete outputs. The 
voting scheme will shutdown the engine under the following votes: 

[00041] NPEngl + NPEng2 = derivative path + non-derivative path 

[00042] NPEng2 + NPEng3 = derivative path + non-derivative path 

[00043] NPEngl + NPEng3 = derivative path + non-derivative path 

[00044] This voting scheme ensures that under all valid votes, one derivative and 
one non-derivative engine speed signal path lane detects an overspeed condition. It 
should be noted that the disclosed control system provides high side and low side 
drivers to each of solenoids 32a and 32b. As shown, Lane #1 of Channels A and B 
control the high side drivers for solenoids 32a and 32b and Lane #2 of Channels A and 
B controls the low side drivers for each of these solenoids. 

[00045] Referring Fig. 3, there is illustrated a schematic diagram showing the 

engine shut down logic path of Fig. 2, with a hardware latch 40 interposed between the 
two Analog Overspeed Limiter Lanes of Channel A and the shutdown coil 32a of fuel 
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shutoff solenoid 32. The hardware latch includes two latches 42a, 42b in 
communication with reset logic and respective field effect transducers (FET) 46a 5 46b, 
which communicate with the shutdown coil 32a of solenoid valve 32. Channel B has 
an identical hardware latch configuration. 

[00046] Referring to Fig. 4, there is illustrated a schematic diagram showing the 

engine shut down logic path and hardware latch of Fig. 3, with software test interfaces 
50 and 52. Interface 50 is associated with input side of the two Analog Overspeed 
Limiter Lanes of Channel A. Interface 50, for Lane 1 includes a 6.5 second self test 
window. Software test interface 52 is associated with the latch reset logic. Channel B 
has an identical software interface associated therewith. 

[00047] Referring to Fig. 5, there is illustrated a schematic diagram showing the 

engine shutdown logic path with hardware latch as shown in Fig. 3, combined with a 
minimum flow logic path, for the two Analog Overspeed Limiter Lanes of Channel A. 
In this configuration, Lane 1 includes a derivative path and hysterisis. The combined 
system of Fig. 5 includes software enable shutdown logic 60 which is selected only 
when: 1) at high altitude; and 2) the logic detects a loss of load signal (Npdot, Nrdot, 
Ngc, etc.). In this configuration, the software enable shutdown logic 60 communicates 
with the shutdown coil 32a of fuel shutoff solenoid 32, while the two Analog 
Overspeed Limiter Lanes communicate with the shutdown coil 32a and the minimum 
flow coil 28a of the true minimum flow overspeed solenoid valve 28 through FET's 
62a, 62b. Channel B has identical software enable shutdown logic. It should be noted 
that the disclosed control system provides high side and low side drivers to each of 
solenoids 28a and 28b. As shown, Lane #1 of Channels A and B control the high side 
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drivers for solenoids 28a and 28b and Lane #2 of Channels A and B controls the low 
side drivers for each of these solenoids. 

[00048] Referring now to Fig. 6, there is illustrated a schematic diagram showing 

the combined minimum fuel flow logic path and engine shutdown logic path of Fig. 5, 
with cross-engine inhibit features, for the two Analog Overspeed Limiter Lanes of 
Channel A. In this configuration, the software enable shutdown logic communicates 
with the shutdown coil 32a of solenoid valve 32, as in Fig. 5. The cross-engine inhibit 
logic 70 runs through nodes that are upstream from the input node for the software 
enable shutdown logic 60, and it communicates with the shutdown coil 32a of solenoid 
32 and the minimum flow coil 28a of solenoid 28. The cross-engine inhibit logic 70 
serves to detect when either the shutdown coil 32a or minimum flow coil 28a has been 
energized, and provides a corresponding discrete output signal to each channel of the 
opposite engine's ECU. Channel B has an identical cross-engine inhibit logic 
arrangement. 

[00049] Referring to Fig. 7, there is illustrated a schematic diagram of an 

alternate embodiment of the two Analog Overspeed Limiter Lanes of Channel A. This 
circuit provides a more precise test of the derivative path in Lane 1, as compared to the 
software test interfaces of Fig. 4. Channel B has an identical arrangement. 

[00050] Although the subject invention has been described with respect to 
preferred embodiments, those skilled in the art will readily appreciate that changes and 
modifications may be made thereto without departing from the spirit and scope of the 
subject invention as defined by the appended claims. 
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